Update the HSM Password for HSM Key Certificates Stored in the Secure Proxy System Store
About this task
Use the manageKeyCerts -updateHsmPass command after you change the password for the HSM, using the HSM administration utilities. Stop CM before you run this command.
- This command does not change the HSM keystore password. It is changed through the HSM administration utilities. You must stop and restart the engine after you change a key store password through the HSM administration utilities.
- If you define the engine parameter, this command first tries to load the HSM keys with their current passwords. If a key cannot be loaded, it tries to load the HSM keys with the new password. If the key is successfully loaded, the password for the key is updated on Secure Proxy. HSM support must be enabled at the engine to use this command. If netHSM is used and multiple engines access the netHSM, any of the engines can be specified to handle the request.
- To update the keystore password on all system certificates, define the certStore=* parameter.
To update the password of the HSM on the Secure Proxy system certificate store, type the following command:
manageKeyCerts -updateHsmPass [parameters]Following is a description of the updateHsmPass parameters:
| Parameter |
Description |
|---|---|
certStore |
Name of the system certificate store where the key certificates are stored. This field is optional. Default=dfltKeyStore. |
engine |
Name of the engine with access to the HSM. Optional. |
systempass |
CM system passphrase. |
adminid |
Administrator ID. Optional. Prompts if not defined. |
adminpass |
Administrator password. Optional. Prompts if not defined. |
newKeyStorePass |
New HSM keystore password. Optional. For Safenet, the new user PIN for the slot used by Secure Proxy. For Thales, the new passphrase for the operator smart card that will be used to protect the key. The card must be inserted in the module's card reader. |